diff options
| -rw-r--r-- | lib/private/AppFramework/Http/Request.php | 3 | ||||
| -rw-r--r-- | tests/lib/AppFramework/Http/RequestTest.php | 25 |
2 files changed, 28 insertions, 0 deletions
diff --git a/lib/private/AppFramework/Http/Request.php b/lib/private/AppFramework/Http/Request.php index be35f4d172f..fd43d468568 100644 --- a/lib/private/AppFramework/Http/Request.php +++ b/lib/private/AppFramework/Http/Request.php @@ -490,6 +490,9 @@ class Request implements \ArrayAccess, \Countable, IRequest { * @return bool */ private function cookieCheckRequired() { + if ($this->getHeader('OCS-APIREQUEST')) { + return false; + } if($this->getCookie(session_name()) === null && $this->getCookie('nc_token') === null) { return false; } diff --git a/tests/lib/AppFramework/Http/RequestTest.php b/tests/lib/AppFramework/Http/RequestTest.php index 6c6504b4de8..cc4bbee2d8d 100644 --- a/tests/lib/AppFramework/Http/RequestTest.php +++ b/tests/lib/AppFramework/Http/RequestTest.php @@ -1787,6 +1787,31 @@ class RequestTest extends \Test\TestCase { $this->assertFalse($request->passesLaxCookieCheck()); } + public function testSkipCookieCheckForOCSRequests() { + /** @var Request $request */ + $request = $this->getMockBuilder('\OC\AppFramework\Http\Request') + ->setMethods(['getScriptName']) + ->setConstructorArgs([ + [ + 'server' => [ + 'HTTP_REQUESTTOKEN' => 'AAAHGxsTCTc3BgMQESAcNR0OAR0=:MyTotalSecretShareds', + 'HTTP_OCS_APIREQUEST' => 'true', + ], + 'cookies' => [ + session_name() => 'asdf', + 'nc_sameSiteCookiestrict' => 'false', + ], + ], + $this->secureRandom, + $this->config, + $this->csrfTokenManager, + $this->stream + ]) + ->getMock(); + + $this->assertTrue($request->passesStrictCookieCheck()); + } + /** * @return array */ |